ZDI-26-192: Sonos Era 300 SMB RCE Vulnerability

TL;DR

Unauthenticated RCE vulnerability in Sonos Era 300 SMB response allows attackers to execute arbitrary code remotely with no authentication required.

What happened

['Sonos Era 300 devices have a critical vulnerability that enables unauthenticated remote code execution via out-of-bounds access']

Why it matters for ops

['This flaw can be exploited by remote attackers without needing any credentials, allowing them to control the device remotely and potentially gain access to internal networks.']

Mitigation

• Apply firmware updates as soon as they become available
• Implement network segmentation to isolate affected devices

Action items

• Update affected Sonos Era 300 devices immediately
• Monitor for suspicious SMB activity and anomalous behavior

Detection IOCs

• Unusual SMB traffic patterns from unexpected IP addresses
• Anomalous remote code execution attempts on Sonos Era 300 devices

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-192/